Subject: [keyassure] rapid conclusion or pandoras box

From: [email-masked]
Date: Mon, 30 Aug 2010 21:55:41 +0000

a quick review of the recent thread on SSHFP led me to go look at the repository, here:

http://www.iana.org/assignments/dns-parameters

and there seem to be a number of potentially applicable RR types.  I've extracted the
following list:

SIG          24 for security signature                      [RFC4034][RFC3755][RFC2535]
KEY          25 for security key                            [RFC4034][RFC3755][RFC2535]
GPOS         27 Geographical Position                       [RFC1712]
LOC          29 Location Information                        [RFC1876]
EID          31 Endpoint Identifier                         [Patton]
NIMLOC       32 Nimrod Locator                              [Patton]
KX           36 Key Exchanger                               [RFC2230]
CERT         37 CERT                                        [RFC4398]
DS           43 Delegation Signer                           [RFC4034][RFC3658]
SSHFP        44 SSH Key Fingerprint                         [RFC4255]
IPSECKEY     45 IPSECKEY                                    [RFC4025]
DNSKEY       48 DNSKEY                                      [RFC4034][RFC3755]
NSEC3PARAM   51 NSEC3PARAM                                  [RFC5155]
HIP          55 Host Identity Protocol                      [RFC5205]
RKEY         57 RKEY                                        [Reid]
TALINK       58 Trust Anchor LINK                           [Wijngaards]

at one point or another, all of these either have delt with certs/naked keys.

so how specific is this work going to be?  just SSHFP <-> openssh or as DRC seems to
suggest, are more careful review of an API method?

--bill